23fc1b592928e00c8b7550fefe5b59f7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

23fc1b592928e00c8b7550fefe5b59f7_JaffaCakes118
Size

14.2MB
MD5

23fc1b592928e00c8b7550fefe5b59f7
SHA1

d9b5aca309191df95460d6a8150ceb589757f327
SHA256

e99ea53bdde73afcab81cbc8bc15a6fcd4aa8653e71cb8618375942e2eef838c
SHA512

6760f0200aa1a38603fe5945840cb6f704c9e0c953b2f621d279b889587285e2b92b2815d2bebe4a6ee48eea6179b6734efdf7108d3a26df92f3bd1558decce6
SSDEEP

393216:GBidQIWCsxCWs+Gh0WU5hy6cHJfZeULpMgB:ddQIzqCB+Sd2yXfZFlMQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 15 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ImmunityDebugger_setup.exe
unpack001/immdbg plugins/Analyze This v0.1/analyzethis.dll
unpack001/immdbg plugins/Asm2clipboard v0.1/Asm2Clipboard.dll
unpack001/immdbg plugins/Cleanup Ex v1.12.108/CleanupEx.dll
unpack001/immdbg plugins/Crypto Scanner 0.5b (Immunity)/ImmCScan.dll
unpack001/immdbg plugins/FullDisasm v1.71/FullDisasm.dll
unpack001/immdbg plugins/HideOD v0.17/HideOD.dll
unpack001/immdbg plugins/IsDebugPresent v1.4/IsDebugPresent.dll
unpack001/immdbg plugins/ODBGScript v1.65/ODbgScript.dll
unpack001/immdbg plugins/OllyDbg PE Dumper v3.03/PEDumper.dll
unpack001/immdbg plugins/OllyDump v3.00.110/OllyDump.dll
unpack001/immdbg plugins/PhantOm Plugin v1.20/PhantOm.dll
unpack001/immdbg plugins/Ultra String Reference v0.12/ustrref.dll
unpack001/immdbg plugins/Windows Maximizer v1.0/WinMax.dll
unpack001/immdbg scripts/!hidedebug PyCommand v1.0/CheckDebug.EXE

Files

23fc1b592928e00c8b7550fefe5b59f7_JaffaCakes118
.zip
ID_signkey_pub.asc
ImmunityDebugger_setup.exe
.exe windows:4 windows x86 arch:x86

18bc6fa81e19f21156316b1ae696ed6b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
lstrcmpiA
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
CopyFileA

user32

ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ImmunityDebugger_setup.exe.sig
immdbg plugins/Analyze This v0.1/analyzethis.dll
.dll windows:4 windows x86 arch:x86

49545c86b429e23c33e31f57921ce8e2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

immunitydebugger.exe

_Addtolist
_Analysecode
_Error
_Findmodule
_Getdisassemblerrange
_Plugingetvalue

kernel32

CloseHandle
CreateFileA
ExitProcess
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentThreadId
GetEnvironmentStrings
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapFree
LoadLibraryA
RaiseException
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WriteFile

user32

EnumThreadWindows
MessageBoxA
wsprintfA

Exports

Exports

_IMMDBG_Pluginaction
_IMMDBG_Pluginclose
_IMMDBG_Plugindata
_IMMDBG_Plugindestroy
_IMMDBG_Plugininit
_IMMDBG_Pluginmenu
_IMMDBG_Pluginreset
___CPPdebughook

Sections

.text
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
immdbg plugins/Analyze This v0.1/readme.txt
immdbg plugins/Asm2clipboard v0.1/Asm2Clipboard.dll
.dll windows:4 windows x86 arch:x86

de62db2eb6fd47d4b01d3a4a57a0941d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalUnlock
GlobalLock
GlobalAlloc
CloseHandle
RtlUnwind
FlushFileBuffers
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetStdHandle
LoadLibraryA
GetProcAddress
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc

user32

wsprintfA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
InvalidateRect
MessageBoxA

immunitydebugger.exe

ord88
ord101
ord44
ord38
ord31
ord12
ord1
ord49
ord46
ord114
ord30
ord28
ord2

Exports

Exports

_IMMDBG_Pluginaction
_IMMDBG_Pluginclose
_IMMDBG_Plugindata
_IMMDBG_Plugindestroy
_IMMDBG_Plugininit
_IMMDBG_Pluginmainloop
_IMMDBG_Pluginmenu
_IMMDBG_Pluginreset

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
immdbg plugins/Cleanup Ex v1.12.108/CleanupEx.dll
.dll windows:4 windows x86 arch:x86

51959a497ad7edaa5b645b23ebe316c8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

immunitydebugger.exe

_Addsorteddata
_Addtolist
_Createsorteddata
_Deletesorteddata
_Destroysorteddata
_Getsortedbyselection
_Infoline
_Message
_Painttable
_Plugingetvalue
_Quicktablewindow
_Registerpluginclass
_Tablefunction

kernel32

CloseHandle
CreateFileA
DeleteFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentThreadId
GetEnvironmentStrings
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapFree
LoadLibraryA
MultiByteToWideChar
RaiseException
ReadFile
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WideCharToMultiByte
WinExec
WriteFile
WritePrivateProfileStringA
lstrcmpiA

user32

AppendMenuA
CreatePopupMenu
DefMDIChildProcA
DestroyMenu
DialogBoxParamA
EndDialog
EnumThreadWindows
GetDlgItem
GetKeyState
GetSystemMetrics
GetWindowRect
InvalidateRect
IsDlgButtonChecked
MessageBoxA
MoveWindow
SendMessageA
wsprintfA

Exports

Exports

_IMMDBG_Pluginaction
_IMMDBG_Plugindata
_IMMDBG_Plugininit
_IMMDBG_Pluginmenu
___CPPdebugHook

Sections

.text
Size: 38KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
immdbg plugins/Crypto Scanner 0.5b (Immunity)/ImmCScan.dll
.dll windows:4 windows x86 arch:x86

a5368278e1252e86ee218053b4488f17

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

SetWindowTextA
SetWindowLongA
SendMessageA
MessageBoxA
LoadIconA
GetWindowLongA
GetDlgItem
EndDialog
EnableWindow
CreateDialogParamA
CharUpperA
wsprintfA

kernel32

lstrlenA
lstrcpyA
lstrcmpA
lstrcatA
CloseHandle
CreateFileA
CreateThread
GetFileSize
GlobalAlloc
GlobalFree
ReadFile
RtlZeroMemory

immunitydebugger.exe

ord88
ord114
ord107
ord109
ord108
ord32
ord2

Exports

Exports

_IMMDBG_Pluginaction
_IMMDBG_Pluginclose
_IMMDBG_Plugindata
_IMMDBG_Plugindestroy
_IMMDBG_Plugininit
_IMMDBG_Pluginmenu
_IMMDBG_Pluginreset

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 1015B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
immdbg plugins/Crypto Scanner 0.5b (Immunity)/Readme.txt
immdbg plugins/FullDisasm v1.71/FullDisasm.dll
.dll windows:4 windows x86 arch:x86

f36fb9e63423f29c7cddc7dbc68dfbd8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
ReadFile
ReadProcessMemory
GetModuleHandleA
WriteFile
lstrcmpA
CreateFileA
VirtualProtect
CloseHandle

user32

EndDialog
InvalidateRect
IsDlgButtonChecked
LoadIconA
MessageBoxA
SendMessageA
UpdateWindow
DefWindowProcA
CheckDlgButton
DialogBoxParamA

gdi32

SetTextColor
ExtTextOutA

Exports

Exports

_IMMDBG_Pluginaction
_IMMDBG_Plugindata
_IMMDBG_Plugininit
_IMMDBG_Pluginmenu
_IMMDBG_Pluginshortcut

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 862B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
immdbg plugins/HideOD v0.17/HideOD.dll
.dll windows:4 windows x86 arch:x86

a1beea8492ef4aa06ca91256f470c20e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenProcess
GetThreadSelectorEntry
GetThreadContext
GetProcAddress
GetModuleHandleA
VirtualAllocEx
GetVersion
VirtualQueryEx
VirtualAlloc
VirtualFree
VirtualFreeEx
CloseHandle
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
RtlUnwind
LoadLibraryA
GetCommandLineA
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
HeapReAlloc

user32

CheckDlgButton
EndDialog
IsDlgButtonChecked
wsprintfA
MessageBoxA
DialogBoxParamA

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

immunitydebugger.exe

ord92
ord107
ord78
ord186
ord85
ord89
ord60
ord53
ord88
ord101
ord117
ord2

Exports

Exports

_IMMDBG_Pluginaction
_IMMDBG_Plugindata
_IMMDBG_Plugininit
_IMMDBG_Pluginmainloop
_IMMDBG_Pluginmenu
_IMMDBG_Pluginreset
_IMMDBG_Pluginshortcut

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
immdbg plugins/HideOD v0.17/ReadMe.txt
immdbg plugins/IsDebugPresent v1.4/IsDebugPresent.dll
.dll windows:4 windows x86 arch:x86

feb8458589fa2b34c639b1183bed7bbf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
CreateThread
ExitThread
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
Sleep
WriteFile
lstrcpyA

user32

SetDlgItemTextA
SendMessageA
MessageBoxA
GetDlgItem
EndDialog
DialogBoxParamA
wsprintfA
GetDlgItemTextA

immunitydebugger.exe

ord88
ord89
ord92
ord114
ord117
ord101
ord60
ord53
ord2
ord35
ord54

comdlg32

GetSaveFileNameA

Exports

Exports

_IMMDBG_Pluginaction
_IMMDBG_Pluginclose
_IMMDBG_Plugindata
_IMMDBG_Plugindestroy
_IMMDBG_Plugininit
_IMMDBG_Pluginmenu
_IMMDBG_Pluginreset

Sections

.text
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 294B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
immdbg plugins/ODBGScript v1.65/ODbgScript.dll
.dll windows:4 windows x86 arch:x86

58f365f58b2227d12c30334a7588e05f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

immunitydebugger.exe

ord93
ord90
ord88
ord101
ord172
ord108
ord53
ord60
ord89
ord104
ord12
ord2
ord73
ord105
ord92
ord114
ord107
ord113
ord71
ord87
ord100
ord74
ord1
ord28
ord141
ord144
ord142
ord149
ord44
ord75
ord5
ord4
ord186
ord3
ord45
ord117
ord23
ord27
ord106
ord77
ord25
ord79
ord24
ord169
ord109
ord42
ord175
ord160
ord61
ord131
ord157
ord33
ord13
ord31
ord46
ord19
ord11
ord78
ord10
ord165
ord161
ord32
ord48
ord102
ord129
ord174
ord124

user32

DefMDIChildProcA
CloseWindow
PostMessageA
DestroyWindow
DialogBoxParamA
GetWindowRect
CreateMenu
GetDlgItemTextA
SetDlgItemTextA
SetWindowPos
GetDlgItem
AppendMenuA
SendMessageA
LoadIconA
InvalidateRect
CreatePopupMenu
DestroyMenu
GetKeyState
EndDialog
SetForegroundWindow
SetFocus
EnumThreadWindows
GetParent
GetDesktopWindow
ChildWindowFromPoint
GetClassNameA
IsWindowVisible
MessageBoxA

shlwapi

StrCmpNIA
PathFileExistsA

comdlg32

GetOpenFileNameA

shell32

ShellExecuteA

msvcrt

_adjust_fdiv
_initterm
?terminate@@YAXXZ
_except_handler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
__lconv_init
strncmp
_ftol
ceil
strstr
strtok
fopen
toupper
strncat
??2@YAPAXI@Z
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??3@YAXPAX@Z
free
strrchr
strncpy
malloc
sscanf
strtoul
sprintf
tolower
__CxxFrameHandler
_stricmp
_itoa
_ultoa
strchr
_strupr

msvcp60

?fail@ios_base@std@@QBE_NXZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
?eof@ios_base@std@@QBE_NXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBEHXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z
??_F?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??Bios_base@std@@QBEPAXXZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0logic_error@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z

kernel32

GetTickCount
CloseHandle
WriteFile
LoadLibraryExA
GetProcAddress
FreeLibrary
GetThreadContext
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
GetFullPathNameA
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
GetLastError
FormatMessageA
LocalFree
GetFileSize
ReadFile
HeapCreate
HeapAlloc
HeapFree
CreateFileA
SetFilePointer

Exports

Exports

ExecuteScript
_IMMDBG_Pausedex
_IMMDBG_Pluginaction
_IMMDBG_Pluginclose
_IMMDBG_Plugincmd
_IMMDBG_Plugindata
_IMMDBG_Plugindestroy
_IMMDBG_Plugininit
_IMMDBG_Pluginmainloop
_IMMDBG_Pluginmenu
_IMMDBG_Pluginreset
_IMMDBG_Pluginshortcut

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
immdbg plugins/OllyDbg PE Dumper v3.03/PEDumper.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\MSVS\Projects\PEDumper\Release\PEDumper.pdb

Exports

Exports

_IMMDBG_Pluginaction
_IMMDBG_Plugindata
_IMMDBG_Plugininit
_IMMDBG_Pluginmenu
_IMMDBG_Pluginreset

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.Cream
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
immdbg plugins/OllyDbg PE Dumper v3.03/ReadMe.txt
immdbg plugins/OllyDump v3.00.110/OllyDump.dll
.dll windows:4 windows x86 arch:x86

7f5cf8d34bbc4e2676e63718dd7fab83

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

immunitydebugger.exe

_Addtolist
_Deleteruntrace
_Disasm
_Findmemory
_Findmodule
_Findthread
_Getcputhreadid
_Getstatus
_Plugingetvalue
_Readmemory
_Sendshortcut
_Setcpu
_Settracecondition
_Startruntrace
_Updatelist

comdlg32

GetSaveFileNameA

kernel32

CloseHandle
CreateFileA
ExitProcess
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentThreadId
GetEnvironmentStrings
GetFileSize
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetVersion
GetVersionExA
GlobalAlloc
GlobalFree
GlobalMemoryStatus
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
IsBadStringPtrA
LCMapStringA
LoadLibraryA
RaiseException
ReadFile
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WriteFile
WritePrivateProfileStringA

user32

CallWindowProcA
ClientToScreen
DestroyMenu
DialogBoxParamA
EndDialog
EnumThreadWindows
GetDlgItem
GetDlgItemInt
GetDlgItemTextA
GetSubMenu
GetSystemMetrics
GetWindowRect
GetWindowTextLengthA
IsDlgButtonChecked
LoadMenuA
MessageBoxA
MoveWindow
SendMessageA
SetDlgItemInt
SetDlgItemTextA
SetWindowLongA
SetWindowTextA
TrackPopupMenu
UpdateWindow
wsprintfA

Exports

Exports

_IMMDBG_Pluginaction
_IMMDBG_Pluginclose
_IMMDBG_Plugindata
_IMMDBG_Plugindestroy
_IMMDBG_Plugininit
_IMMDBG_Pluginmainloop
_IMMDBG_Pluginmenu
_IMMDBG_Pluginreset
___CPPdebugHook

Sections

.text
Size: 50KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 488KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Cream
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Cream
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Cream
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Cream
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
immdbg plugins/OllyDump v3.00.110/ollydump300110_src.zip
.zip
Makefile
OllyDump.c
OllyDump.rc
RebuildImport.c
rebIT.c
rebIT.tXt
resource.h
immdbg plugins/PhantOm Plugin v1.20/PhantOm.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

_IMMDBG_Pausedex
_IMMDBG_Pluginaction
_IMMDBG_Pluginclose
_IMMDBG_Plugindata
_IMMDBG_Plugininit
_IMMDBG_Pluginmainloop
_IMMDBG_Pluginmenu
_IMMDBG_Pluginreset

Sections

CODE
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 274B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
immdbg plugins/PhantOm Plugin v1.20/Readme.txt
immdbg plugins/PhantOm Plugin v1.20/Tutorial/Bypass.htm
immdbg plugins/PhantOm Plugin v1.20/Tutorial/Bypass.swf
immdbg plugins/Ultra String Reference v0.12/ustrref.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

_IMMDBG_Pluginaction
_IMMDBG_Pluginclose
_IMMDBG_Plugindata
_IMMDBG_Plugindestroy
_IMMDBG_Plugininit
_IMMDBG_Pluginmenu
_IMMDBG_Pluginreset

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
immdbg plugins/Windows Maximizer v1.0/WinMax.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

_IMMDBG_Pluginaction
_IMMDBG_Plugindata
_IMMDBG_Plugininit
_IMMDBG_Pluginmainloop
_IMMDBG_Pluginmenu

Sections

CODE
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 202B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
immdbg scripts/!bpxep PyCommand v1.01/ReadMe.txt
immdbg scripts/!bpxep PyCommand v1.01/bpxep.py
.py .sh linux
immdbg scripts/!getrpc PyCommand v0.1/getrpc.py
.py .sh linux
immdbg scripts/!getrpc PyCommand v0.1/readme.txt
immdbg scripts/!hidedebug PyCommand v1.0/CheckDebug.EXE
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.Imports
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Code
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
immdbg scripts/!hidedebug PyCommand v1.0/hidedebug.py
.py .sh linux
immdbg scripts/!itunes7_antiantidebug PyCommand v0.1/itunes7_antiantidebug.py
.py .sh linux
immdbg scripts/!itunes7_universal_antiantidebug PyCommand v0.1/itunes7_universal_antiantidebug.py
.py .sh linux
immdbg scripts/!loadmap PyCommand 1.3/loadmap.py
immdbg scripts/!loadmap PyCommand 1.3/readme.txt
immdbg scripts/!packets PyCommand v0.1/packets.py
immdbg scripts/!packets PyCommand v0.1/readme.txt
immdbg scripts/!patch IsDebuggerPresent v0.1/patch.py
.py .sh linux
immdbg scripts/!patch IsDebuggerPresent v0.1/readme.txt
immdbg scripts/!scanpe PyCommand v1.0/ReadMe.txt
immdbg scripts/!scanpe PyCommand v1.0/scanpe.py
.py .sh linux
immdbg scripts/!search PyCommand v0.1/search.py
.py .sh linux
immdbg scripts/!sqlhooker PyCommand v0.1/readme.txt
.vbs
immdbg scripts/!sqlhooker PyCommand v0.1/sql_listener.py
.py .sh linux
immdbg scripts/!sqlhooker PyCommand v0.1/sqlhooker.py
.py .vbs
immdbg scripts/!tickcount PyCommand v0.1/tickcount.py
immdbg scripts/!unmidl PyCommand v0.1/ID-unmidl.zip
.zip
Libs/midlconst.py
Libs/midlutil.py
.py .sh linux
PyCommands/unmidl.py
.py .sh linux
immdbg scripts/!unmidl PyCommand v0.1/readme.txt
immdbg scripts/ASProtect 2.xx Deobfuscation Script v1.1/ASProtect 2.xx Deobfuscation Script v1.1.py
immdbg scripts/ASProtect 2.xx Deobfuscation Script v1.1/readme.txt
immdbg scripts/ASProtect 2.xx Deobfuscation Script/ASProtect 2.xx Deobfuscation Script.py
immdbg scripts/ASProtect 2.xx Deobfuscation Script/readme.txt

Sharing

General

Malware Config

Signatures

Files

18bc6fa81e19f21156316b1ae696ed6b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 153KB

.ndata Size: - Virtual size: 32KB

.rsrc Size: 27KB - Virtual size: 26KB

49545c86b429e23c33e31f57921ce8e2

Headers

File Characteristics

Imports

immunitydebugger.exe

kernel32

user32

Exports

Exports

Sections

.text Size: 29KB - Virtual size: 32KB

.data Size: 9KB - Virtual size: 12KB

.tls Size: 512B - Virtual size: 4KB

.idata Size: 1KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 4KB

de62db2eb6fd47d4b01d3a4a57a0941d

Headers

File Characteristics

Imports

kernel32

user32

immunitydebugger.exe

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 8KB - Virtual size: 10KB

.reloc Size: 4KB - Virtual size: 3KB

51959a497ad7edaa5b645b23ebe316c8

Headers

File Characteristics

Imports

immunitydebugger.exe

kernel32

user32

Exports

Exports

Sections

.text Size: 38KB - Virtual size: 40KB

.data Size: 10KB - Virtual size: 16KB

.tls Size: 512B - Virtual size: 4KB

.idata Size: 2KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 4KB

a5368278e1252e86ee218053b4488f17

Headers

File Characteristics

Imports

user32

kernel32

immunitydebugger.exe

Exports

Exports

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 153KB

.ndata
Size: - Virtual size: 32KB

.rsrc
Size: 27KB - Virtual size: 26KB

.text
Size: 29KB - Virtual size: 32KB

.data
Size: 9KB - Virtual size: 12KB

.tls
Size: 512B - Virtual size: 4KB

.idata
Size: 1KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 4KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 8KB - Virtual size: 10KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 38KB - Virtual size: 40KB

.data
Size: 10KB - Virtual size: 16KB

.tls
Size: 512B - Virtual size: 4KB

.idata
Size: 2KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 4KB

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 1024B - Virtual size: 1015B

.data
Size: 27KB - Virtual size: 28KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 167KB - Virtual size: 166KB

.rdata
Size: 1024B - Virtual size: 862B

.data
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 1024B - Virtual size: 608B

.reloc
Size: 29KB - Virtual size: 28KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 2KB - Virtual size: 4KB

.rdata
Size: 1024B - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 294B

.text
Size: 180KB - Virtual size: 180KB

.rdata
Size: 28KB - Virtual size: 28KB